For Distinguishing Conjugate Hidden Subgroups, 
the Pretty Good Measurement is as Good as it Gets 

Cristopher Moore Alexander Russell 

moore@cs.unm.edu acr@cse.uconn.edu 

■ Department of Computer Science Department of Computer Science and Engineering 

^ ! University of New Mexico University of Connecticut 



February 1, 2008 



Abstract 

' Recently Bacon, Childs and van Dam showed that the "pretty good measurement" (PGM) is optimal 

^SJ , for the Hidden Subgroup Problem on the dihedral group _D„ in the case where the hidden subgroup is 

chosen uniformly from the n involutions. We show that, for any group and any subgroup H, the PGM 
CO ' is the optimal one-register experiment in the case where the hidden subgroup is a uniformly random 

^ , conjugate of H. We go on to show that when H forms a Gel'fand pair with its parent group, the PGM is 

the optimal measurement for any number of registers. In both cases we bound the probability that the 
optimal measurement succeeds. This generalizes the case of the dihedral group, and includes a number 
of other examples of interest. 

o 

^ '. 1 The Hidden Conjugate Problem 



Consider the following special case of the Hidden Subgroup Problem, called the Hidden Conjugate Problem 
in [16]. Let G be a group, and H a non-normal subgroup of G; denote conjugates of H as = g~^Hg. 
Then we are promised that the hidden subgroup is for some g, and our goal is to find out which one. 
' The usual approach is to prepare a uniform superposition over the group, entangle the group element 

^ I with a second register by calculating or querying the oracle function, and then measure the oracle function. 

This yields a uniform superposition over a random left coset of the hidden subgroup, 

^ Rather than viewing this as a pure state where c is random, we may treat this as a classical mixture over 

left cosets, giving the mixed state with density matrix 

P9-j^^J2\^H^)(^H^\ ■ (1-1) 

We then wish to find a positive operator-valued measurement (POVM) to identify g. 

A POVM consists of a set of positive measurement operators {Ei} that obey the completeness condition 

Y.E,=1. (1.2) 

i 

If we are trying to distinguish £ density matrices {pi | 1 < ^ < and if pi is chosen with probabihty p.j, the 
probabihty that the POVM gives the right answer is 



-^success — ^ ^ tl* EjPi . (1-3) 
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A theorem of Yuen, Kennedy and Max [22] and Holevo [9] states that Psuccoss is maximized if and only 
if the following conditions hold for every i: 

Y^PjPjEj -p^p}j E, =0 , (1.4) 

^PjPjEj =Y^PjEjPj , and (1.5) 

i 3 

^PjPjEj >pip, , (1.6) 

3 

where we write A > B if A — B is positive semidefinite. These conditions come from recognizing that 
maximizing Psuccoss subject to the completeness condition (1.2) gives a semidefinite program. Ip [11] used 
this fact to show that Shor's algorithm is optimal for the hidden subgroup problem on the cyclic group Z„. 

In a beautiful recent paper, Bacon, Childs and van Dam [1] consider the hidden conjugate problem for 
the dihedral group D„ where H is an order-2 subgroup; that is, when the hidden subgroup consists of the 
identity and one of the n involutions. They consider entangled measurements over multiple registers each 
of which contains a coset state, and show that the so-called "pretty good measurement" [7], defined below, 
is in fact optimal for any number of registers. They then show that this optimal measurement is related to 
random cases of the Subset Sum problem (see also Regev [18]). Other prior work includes Eldar, Megretski, 
and Verghese [4], who showed that the PGM is optimal for certain families of density matrices related by 
group symmetries; see references in that paper for some other cases for which the PGM is optimal. 

In this paper we point out that for any subgroup _ff of a group G, the pretty good measurement is the 
optimal one-register experiment for finding a hidden conjugate of H when all conjugates are equally likely. 
We then write a general expression for the probability Psuccoss that this measurement identifies the hidden 
conjugate in a single experiment on a coset state. We then go on to show that when G and H form a Gel'fand 
pair, the pretty good measurement is in fact the optimal measurement on any number of registers. This 
recovers the optimality result of [1] as a special case, and establishes optimal measurements for a variety of 
other interesting group-subgroup pairs, including the subgroups of the affine groups studied in [16]. 

We use the machinery of representation theory; we refer the reader to [6, 20] or to the review in our 
paper [14] for an introduction and for notation. 



2 The one-register case 

2.1 The pretty good measurement is optimal 

The pretty good measurement (PGM), also known as the least squares measurement, is defined as follows [7]. 
Given a set of density matrices pi with associated probabilities pi , let 

M = ^PiPz- 

i 

Then the PGM associated with this family of mixed states is {Ei}, where the measurement operator Ei is 
defined as 

=p,M-i/2^,M-i/2 (2.1) 

where the inverse M~^/^ is defined on the image of A/; that is, Af ^^/^ is the unique positive operator such 
that (A'/~^/^)^Af is the projection operator 11 onto the image of M. If M has full rank, it is easy to see that 
this choice of {Ei} satisfies the completeness condition (1.2); if the image of Af is a proper subspace, we 
satisfy the completeness condition by adding an additional measurement which projects onto its orthogonal 
complement. 
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We will show that the optimality conditions (1.4), (1.5), and (1.6) hold for the PGM for the family of 
density matrices {pg} defined above when endowed with the uniform distribution = 1/|G|. First we derive 
the structure of the PGM. Observe that the mixed state pg = \G\~^ J2c |c-ff^) {cH^\ has the property that 

2 1^1 /o o^ 

Pg = ^P. (2.2) 

so that Pg is a projection operator scaled by the constant |_ff|/|G| (this follows from the fact that the 
uniform distribution on any subgroup is its own square under convolution). As trpg ~ 1, we must have 
rk Pg = \G\/\H\, the index of H in G. 

Note that pg commutes with the left action of G, since it is "symmetrized" over all left cosets. By Schur's 
lemma, pg is block diagonal, with blocks corresponding to the decomposition of C[G] into bi- invariant spaces. 
Furthermore, the block corresponding to the irreducible representation a has form Aa- (g) l^^ , where 1^^ acts 
within each left-invariant space. Recalling (2.2), A^^ is a rescaled projection operator, and we may write 
Pa = ®aeG Pg ^^^^re 

^9 |G| 



® irf. ; (2.3) 



here tt?' is the projection operator 



' ' heHs 

Since rk tt^ does not depend on g, we denote it simply as rk tt°' . Then the following lemma describes 
the structure of the PGM for {pg}. Since pg = ph whenever g and h are in the same coset of the normalizer 
Norm(i?) = {g \ = H}, without loss of generality we assume that the POVM gives a uniformly random 
element of some coset of Noim{H), and we count it as having succeeded if it gives an element of the correct 
coset. Thus we will multiply Psuccoss by the index of Norm(_ff ) below. 

Lemma 1. For the family {pg} of density matrices corresponding to random left cosets of conjugate subgroups 
with the uniform distribution on g, the pretty good measurement operators Eg are given by 



Eg = ®El 



and, for each a € G, 



Eg=T7^,^<®t,^ (2.5) 



\G\rkTT° 
where tt^ is defined as in (2.3). 

Proof. For each x £ G, let Lx and Rx denote the unitary operators that carry out left and right group 
multiplication by x. Note that left cosets are mapped to each other by Lx and, in particular, \cH) = Lc \H). 
Note furthermore that Rx maps left cosets of one conjugate onto left cosets of another conjugate, e.g., 
\H^) — Rg |(7~^iJ), and that Lx commutes with Ry for all x, y. 
We have Pg = 1/|G| for all g. Now if we write 



-l^Y.LcRg\H) {H\RlLl 



c,g 



(where in the third equality we replace cg~^ with c), we see that M commutes with Lx and Rx for all x G. 
That is, summing over both the left coset and the choice of conjugate "symmetrizes" M on both the left 
and the right. It follows by Schur's lemma that M takes the form 

M = Ar 
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where M*^ is a scalar multiple of the identity operator for each a. As 

S 9 

by taking traces we conclude that 

— 

\\G\ 

Similarly, pg is block-diagonal, as it commutes with L^, (though not with unless H is normal). 
Therefore, M commutes with pg for each g, and (2.1) becomes 

Eg - J^\M-'P9 (2-6) 

giving, in each irreducible block, 

which completes the proof. □ 

We now give our proof that the PGM is optimal for the hidden conjugate problem for any G and H. 
This follows simply from the fact that M, and therefore Eg, commutes with pg for each g. 

Theorem 2. For the family {pg} of density matrices corresponding to random left cosets of conjugate 
subgroups with the uniform distribution on g, the pretty good measurement {Eg} optimizes the probability 
of correctly measuring g. 

Proof. Since the Eg and pg are block-diagonal (according to the same decomposition of C[G]), it suffices to 
confirm the optimality criteria (1.4), (1.5), and (1.6) in each block, i.e., for each a E G. 

First, (1.5) holds trivially since Eg is proportional to Pg for each g, and so commutes with it. As for 
condition (1.6), observe that from (2.2) and (2.7) we have 

^'^"^^ = w^^'^ ^'-'^ 

and so for any h <E G, recalling that pg = l/\G\ for all g, we have 
since ld„ > ttJ^. Finally, for any h £ G 



since (1 — 7r)7r = for any projection operator tt. Again recalling pg — 1/\G\ establishes (1.4) and completes 
the proof. □ 

Note that Lemma 1 and Theorem 2 imply that, as pointed out before [11, 13, 14], the optimal measurement 
consists of first measuring the representation name cr, and then performing an additional measurement Mg 
inside the bi-invariant space corresponding to a. 
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2.2 Partial measurements 



Suppose that rather than trying to identify the conjugate exactly, we wish to learn some partial information 
about it. To learn one bit, for instance, we would divide the set of conjugates into two equal subsets, and 
combine the Pg into two mixed states po Pi consisting of mixtures of those in the two subsets. The next 
theorem shows that the PGM is optimal for any such partial measurement as long as each subset of the set 
of conjugates has probability proportional to its size. 

Theorem 3. Let C{H) = {H^} be partitioned into disjoint sets Ci, 1 < i < i- Let 



\C 

where pg is as in (1.1), and letpi = |Ci|/|C(i?)|. Then the pretty good measurement Jar the family {pi} with 
probabilities pi is the family of operators {Ei } 

E., = ^ Eg , 

where Eg is given by Lemma 1; this measurement is optimal. 

Proof. The proof is exactly the same as that of Lemma 1 and Theorem 2, except that for each i we sum 
over the g with € Ci. □ 

2.3 The probability of success 

As a corollary to Theorem 2, we can determine the optimal success probability. Let C{H) denote the set of 
conjugates of H . For a group G the Plancherel measure is the probability distribution on G assigning a € G 
the probability d'^/\G\; this is the fraction, dimensionwise, of C[G] consisting of the bi-invariant subspace 
corresponding to a. For a set 5* C G, we let Planch(5) denote the probability of observing an element of 
S according to the Plancherel measure. We remark that the Plancherel measure is precisely the probability 
distribution obtained by performing weak Fourier sampling when the hidden subgroup is trivial, since in 
that case the state p is completely mixed. 

Given a subgroup H of G, let Sh C G denote the set of irreducible representations for which the 
projection operator tt'^ = \H\^^ J2heH nonzero, and let He = ^gEl^ denote the largest normal 
subgroup contained in H. Then the following theorem gives the success probability of the optimal one- 
register experiment. 

Theorem 4. Given a group G and a subgroup H , the probability that the optimal single-register measurement 
correctly identifies a uniformly random conjugate of H is 

Proof. Let us say that g ^ g' if = (and so pg = pgi). Then Psucccss is the expectation 

^success — -^-^P(; ^ ^ Eg' Pg , 

where g is selected uniformly in G. Since g ~ g' if and only if g and g' are in the same (right) coset of the 
normalizer Norm(i7) = {g | = H}, we have 

^success = |Norm(i7)| • ExpgtrEgPg = |Norm(i/)| • Exp^ ^tr^Jp^ . 
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tvE^pl = '-j^ = ^Planch(a) 



Considering (2.3) and (2.8), we have 

\H\^JH\ 
\G? \G\ 

but only for those a where Pg and E'^ are nonzero, i.e., those for which rk tt'^ > 0. Thus, we conclude that 

Psuccc. = '^°™[5^"^' • E = ^ • Planch(^,) 

where we recall that \C{H)\ = |G'|/|Norm(i/)|. 

Now, note that for any subgroup C iJ, we have Su C Sk since any a that annihilates K also annihilates 
H . In addition, if K is normal, recall that for any a we have either tt^ = or tt^ = 1. It follows that 
EcrsS '^a = X^cres - rfcrfk TT^ = rk 7rj^ where R is the regular representation, and since rk TrjJ = |G|/|/ir| 
we have Planch(5A'j' = Thus Planch(S'if) < I/IFgI, completing the proof of (2.9). □ 

Note that if we observe any a ^ Su^ we know that the promise that the hidden subgroup is a conjugate 
of H has been violated. Thus, as in [1], if we are promised that the hidden subgroup is either trivial or 
a conjugate of iJ, we can complete the PGM with an additional measurement operator Mq that projects 
onto the orthogonal complement of Sui and conclude that the hidden subgroup is trivial if we observe the 
outcome Mq. 

It is interesting to compare Theorems 2 and 4 with known results on the hidden subgroup problem. For 
the dihedral group £)„ where H is an order-2 subgroup, there are n conjugates, and Su consists of all of G 
except for the sign representation. Thus we have 

_ 2 / ^ 

-^success — 1 1 7^ 

n \ In 

On the other hand, for the affine group Ap, the maximal subgroup H = Z* has p conjugates, and Sh includes 
all but the p — 2 nontrivial one-dimensional representations. This gives 

P -p-u^ p-^ Vi 

-'success — \ ^ / i\l ^ 9 

p \ p[p-^)J p 

Indeed, Moore, Rockmorc, Russell and Schulnian [16] gave an explicit algorithm using a von Neumann 
measurement that succeeds with constant probability. This algorithm can easily be modified to carry out 
the optimal POVM in polynomial time; see also Bacon, Childs and van Dam [2]. 

Now let us consider the case of the hidden subgroup problem relevant to Graph Isomorphism in the case 
of two rigid, connected graphs of size n/2. Here G ~ S„ and H is the order-2 subgroup consisting of n/2 
disjoint transpositions, 

H = {l,(12)(34)---(n-ln)} 

of which there are {n — 1)!! conjugates, one for each perfect matching of n items. Using lemmas proved 
in [14], it is easy to show that for almost all representations a (with respect to the Plancherel distribution) 
we have rk 7r°' = (1 ± o(l))dcr/2, so Planch(5H) = 1 — o(l). Thus we have 

(n — 1)!! 

This can be generalized to other conjugacy classes using general character bounds due to Roichman [19]; see 
also Kempe and Shalev [12]. 

However, it should be emphasized that the fact that Psuccoss is exponentially small does not mean that 
we need an exponential number of single-register experiments to solve the hidden conjugate problem. In 
particular, Ettinger and H0yer [5] showed that a polynomial number (i.e., 0(log|G|) = O(logn)) of single- 
register experiments is enough to determine, information-theoretically, an involution in Z3„. Thus our results 
here do not subsume the results of Moore, Russell and Schulman [14] and Moore and Russell [15], who showed 
that it takes an exponential number of single-register experiments, or a super-polynomial number of two- 
register experiments, to obtain even a single bit of information about the conjugate of H in S'„. 
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3 Multiregister measurements and Gel'fand pairs 



For the multiregister experiment, we view states as elements of the Hilbert space C[G'"'] = C[G']®'^'. We now 
have a random left coset of the subgroup H'' C G'^, and the corresponding mixed state is 

Since pf' is symmetrized over left cosets, it commutes with left multiplication in G'^. Thus by Schur's lemma 
it is block-diagonal, where each block corresponds to a representation cr ~ ai (E) ■ ■ ■ <E) Ck of G*^, and each ai 
is an irreducible representation of G. Indeed, in a given such block we can write 

. (3.1) 

The situation in the multiregister case is complicated by the fact that, unlike the one-register case, M 
does not generally commute with p^. Indeed, they do not commute even for the two- register case in the 
dihedral group. We note in passing that they do commute in a few special cases: for instance, when H is 
generated by an involution that commutes with its conjugates. However, this is not a very interesting case, 
since then H and its conjugates generate an Abelian subgroup K C G, and we can distinguish them by 
solving the hidden subgroup problem on K. 

However, we can still prove that the PGM is optimal in the case that G and H form a Gel'fand pair; 
we review the definition here, and also refer the reader to [21] for an introduction. Given a group G and 
a subgroup H, let !B = !Bi/(G) denote the collection of functions f : G ^ C that are invariant under both 
left and right multiplication by H, i.e., such that f{hg) = f{g) = f{gh) for all g G G and h € H. This 
collection of bi-invariant functions forms a natural algebra under convolution, and !B can be identified with 
the subalgebra of C[G] generated by elements corresponding to double cosets, HgH = {J^heH ^)'9'Cl2heH 
Then the following criteria are equivalent, and the pair (G, H) is said to be GeVfand if any of them hold: 

1. S is commutative. 

2. The induced representation Ind^l contains no more than one copy of any particular c G G. 

3. For any cr G G and any / G 23, the Fourier transform /(cr) = /(5)f (.9) li^is rank at most one. 

The third criterion is the one most relevant to our analysis. Suppose (G, H) is a Gel'fand pair; then since the 
uniform distribution on H is an element of B, for any a € G the projection operator tt"' = Sheff 
has rank at most one. Since this is also true of its conjugates tt^ = (7{g)~^Tr'^a{g), we sec that {G,H^) is 
Gel'fand for all g G G. 

As stated above. Bacon, Childs and van Dam [1] showed that the pretty good measurement is optimal 
for the dihedral groups Dn when the hidden subgroup H is of order 2. Indeed, (Mi, H) is Gel'fand for these 
subgroups, and we generalize their result as follows. 

Theorem 5. For any number of registers k > 0, given the family {Pg} of density matrices corresponding 
to random left cosets of conjugate subgroups (H^)'^ C G*' with the uniform distribution on g, the pretty good 
measurement {Eg} optimizes the probability of correctly measuring g. 

Proof. As before, we will show that the optimality conditions hold in each irreducible block, since the p^, 
and therefore M and the Eg, are block-diagonal. Since the tensor product of rank-one operators has rank 
one, given cr = cti (8) • • ■ (Xi cr^ with ai G G for all i, from (3.1) we have either p^ = or 

Pg = \vg) {vg\®^d^ 
for some vector Vg G a. In the latter case we have M"' = m® 1^^ where 
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and 

where C is defined as the inner product 

Similarly, = c_^M'^yi/2 p. _ 

It is easy to see that C does not depend on g: if Rg denotes the unitary operator corresponding to right 
multiplication by the diagonal element {g, . . . ,g) in C[G'""], then \vg) = Rg \vi) and m commutes with Rg. 
Thus C = {vg\m-'^/'^ \vg) = {vi\ Rgm.-'^/'^Rl \vi) = (uilm-^/^ \vi). Then we have 

g 9 9 g 

confirming (1.5). 

As for condition (1.6), recalling the equality Pg^g ~ C(M'^)^/^ just above, (1.6) is equivalent to the 
condition C(M'^)^/^ > Pg, and hence to Cm}/^ > \vg) {vg\. Furthermore, this holds if and only if 



{Vg\Cm^/^\Vg)>{Vg\Vg){Vg\Vg) = \\Vgf 

or, expanding the definition of C, 

{Vg\m^'^\Vg) {Vg\m-^/^\Vg) >\\Vg\\'' . (3.2) 

We remark that if a positive semidcfinitc operator A is a linear combination A ~ ciaBa of positive 
semidefinite operators Ba with e IR+. then the kernel of A is f]^ ker Ba- As m is such a linear combination 
of operators \vg) {vg\, it follows that \vg) is orthogonal to kerm, and therefore lies in the image of m. Thus 
we can regard m^/^ and to~^/^ as inverses, and the inequality (3.2) follows from the following claim: 

Claim 6. Let A be a positive operator on a finite dimensional Hilbert space V and let \v) G V . Then 

{v\A\v){v\A-^\v) > \\v\f . 
Proof. For a vector w = (u)i, . . . , Wn) of non- negative weights and a real number r, define 



M™(xi,...,rE„) 



w,. 



to be the weighted r-mean of the positive vector x = {xi, . . . ,a;„). The power mean inequality (cf. [8, §2.9]) 
asserts that for r < s we have !M™(a;) < M™(x). 

The claim follows immediately from the from power mean inequality with r = — 1 and s = 1. Specifically, 
let B = {\bi)} be a spectral resolution of A, so that B is an orthogonal basis of eigenvectors for V, and let 
Xi > be the associated eigenvalues, so that Xi \bi) ~ A \bi). Writing \v) = J^i "^i we have 

=^|«,|2a, and {v\ A'' \v) =J2\v^\^K' ■ 

i i 

If we adopt the weights Wi = \vi\'^, then '^^Wi = ll^ll^ and the claim is equivalent to the the power mean 
inequality M™i(Ai, . . . , A„) < M5"(Ai, . . . , A„). □ 
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Returning to the proof of Theorem 5, it remains to estabhsh (1.4). Consider 

(E P'^g^a Pl^ K = ^ _ |^^^ ^^^^|^ ^-1/2 |^^^^ ^^^| ^-1/2] ^ 

= 1^ [(n - 1) It-,,) {vh\ (3.3) 

where IT is the projection operator onto the image of to. Since \vh) hcs in this image as discussed above, we 
have n|i)/,,) = \vh) and (3.3) is identically zero. □ 

As in the one-register case, we can distinguish the trivial subgroup from the conjugates of H by completing 
the PGM with a measurement Mq that projects onto the complement of the image of M . 

3.1 The Probability of Success 

In this section we give an upper bound on the success probability of the optimal multiregister experiment for 
Gel'fand pairs. To prepare for this, we record a version of Holevo's theorem on the capacity of a quantum 
channel [10]. 

Lemma 7. Let R ~ {pi | i G /} fee a family of density matrices treated as linear operators on the Hilhert 
space V . Let E = {Ei\ be a family of measurement operators on V for which Ei = t. and, for each i G L, 
Ei is a scalar multiple of a projection operator of rank r. Then 

dim H 
Expi trEip, < — — - , 
r\I\ 

where the index i is chosen uniformly at random in I . 

Proof. By assumption, we may write Ei — ajllj where Ilj is a projection operator of rank r and > 0. As 
Pi is a density matrix, we may write pi ~ 'l2jPj l^j) (''^jl where each \vj) has unit length, each pj G [0, 1], 
and J2jPj ~ 1- Observe that 

tr E,p, = {vj\E, \vj) < "^pjWE.W = \\E,\\ = a, , 

i 3 

where \\A\\ is the operator norm of A, given by \\A\\ = maxv^^^o ll^v|[/||v||. Hence 

Exp, tr < . 

Observe now that ^ ^ Ei ~ t and hence that dim F = tr 1 = tr ^ ^ Ei — a^r; evidently ^ , ai = dim V/ r, 
which completes the proof. □ 

Theorem 8. Let H he a subgroup of G for which [G,H) is a Gel f and pair and let Hq ~ ^gH^ be the 
largest normal subgroup contained in H . The probability that the optimal k -register measurement correctly 
identifies a uniformly random conjugate of H is 

1 f \H\^'" 



Proof. Without sacrificing optimality, we may initially carry out weak Fourier sampling, in which we observe 
a representation cr with probability 

\H\''d^ rk < 
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Again accounting for the fact that = p^, when = , the probabihty of success may then be written 

-Psuccoss = |Norm(i?)| • ExpgtrE'gPg |Norm(H)| • Exp^ Exp^ a^tr E'Jp^ 

where cr is distributed according to Pier), g is uniform in G, and Co- — l/trp^ normahzes Pg so that it is a 
density matrix. 

Recall that Pg is proportional to tt^ (g) 1^^ where tt^ has rank one (or zero) , that M"^ = m (S) ld„ , and 
that the image of tt^ is contained in the image of m. Therefore, m~^/^7rg m"^/^ has rank one or zero, and 
so Eg = m^^/^TTg 771^^/^ (g) Irf^ is either zero or a scalar multiple of a projection operator of rank da-- By the 
lemma above, for a representation cr we have Exp^tr (aa-EgPg) < da-/\G\. 

Let us again define Sjjk C to be the set of representations for which tt^ is nonzero. By commuting 
the two expectations above, we conclude that 

. da- iNormfmi, „ dl \H\'' 

Psucccss < |Norm(i/)| Exp, = J ^L^|i/|^ ^ rk n'^ = -l_L_pianch(5H. ) 

where Planch^fc (c) = d^/|G|'^ is the Plancherel distribution on G'^. But this is just the product of the 
Plancherel distribution on G over the Ci, so we have 

Psuccoss < I ' ' | Planch(gg)^ 
\G{^)\ 

and recalling from the proof of Theorem 4 that Planch(S'/f ) < 1/\Hg\ completes the proof. □ 
3.2 Examples 

Theorem 5 applies to a number of group families that have appeared in the literature on the hidden subgroup 
problem. Here is a short list of examples of Gel'fand pairs: 

• (G, H) where H is normal and G/H is Abelian. Of course, whenever H is normal the hidden conjugate 
problem becomes trivial. 

• {D„ , H) where H consists of the identity and an involution, as in Bacon, Childs and van Dam [1]. 

• {Ap, Z*) where Ap is the affine group Z* k Zp and Z* is a maximal non-normal subgroup. An efficient 
quantum algorithm for the hidden conjugate problem in this case was given by [16]. 

• All the subgroups of the Hcisenbcrg group, for which an information-theoretic reconstruction algorithm 
was given by Radhakrishnan, Rottclcr and Sen [17]. 

• {SL2{q), B) or {GL2{q), B) where B is the Borel subgroup consisting of upper-triangular matrices. 

• (Sn-, H) where H is the hyperoctahedral group; this is the centralizcr of (1 2)(34) ■ • ■ (n— 1 n), or equiva- 
lently the wreath product 5'„/2 ?Z2, or the symmetry group of the (n/2)-dimcnsional hyperoctahedron. 

• {Sn, H) where H = S„i x Sn-m for some < to < n, i.e., the subgroup of permutations under which 
the set consisting of the first m elements is invariant. 

Note there is an efficient classical algorithm for the hidden conjugate problem for the last two examples in 
Sn- simply check for all (2) transpositions whether the oracle differs from its value on the identity. This 
allows us to determine the conjugate of H, which is associated with a matching (for the hyperoctahedral 
group) or a subset of size m (for Sm x Sn)- 
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4 Conclusion 



The hidden conjugate problem has important appUcations; in the dihedral group it is related to hidden shift 
problems [3] and lattice problems [18]. However, for problems such as Graph Isomorphism, we are typically 
interested in distinguishing one conjugacy class from another. While we can detect the trivial subgroup with 
the additional measurement Mq defined here and in [1], the PGM is not generally optimal in this case [D. 
Bacon, personal communication]. Constructing the optimal measurement for the hidden subgroup problem, 
given a prior on the conjugacy classes, remains an important open question. 
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